2

I am setting up a new Windows Server 2008-based domain and I am thinking about the domain name. Some time ago I read some documentation from Microsoft where they advised to use a .local suffix for "internal", corporate domains so that they do not clash with public, internet-exposed domains. For example, if my company is called Acme and our publicly visible domain (including a web site hosted with a colo provider) is acme.com, then our "internal" Windows domain should be named acme.local.

However, some time later I read some other documentation from Microsoft where they contradicted this and advised against it.

What do you think? What's the best way to name an internal domain? Any relevant experiences?

Edit. It seems that, despite of recommending against using the .local suffix for "internal" networks, Microsoft does impose it on some products such as SBS. Are there any reasons why using .local would be clearly a problem?

Thanks.

Improve this question
1
3

The .local domain suffix is not an FQDN and therefore 'non-routable'. This protects your domain somewhat from passing information outside of its perimiter.

For example, a user with a laptop on your internal-only acme.com domain plugs into their home network. It attempts to resolve acme.com and talk to its nearest DC. Your external acme.com is suddently batting off AD-related traffic and that traffic is flowing directly across the internet.

Worst-case scenario is that you pick an internal domain name, and someone else owns that same domain name externally. Now when your users go off-site, their machine attempts to resolve and contact the domain, only to have their traffic being sent to some random company that owns the mysuperdomain.com name out in Timbuktu.

There's also some complications that may arise around internal and external DNS configuration if you choose to use the same name for internal and external domains. Even using a sub-domain of your external domain name (e.g. AD.mycompany.com) can lead to issues with DNS down the line, often in granting internal users access to your resources that are also available externally.

Best practice IMO is using mycompanyname.local for your internal domain, and mycompanyname.com (or such) for external.

Improve this answer
3
  • Thanks Chris. In that case, why is Microsft discouraging from using .local now? – CesarGon Dec 1 '09 at 1:46
  • Hi Cesar. I've not encountered this position from MS. Can you link? Thanks. – Chris Thorpe Dec 1 '09 at 5:01
  • From support.microsoft.com/kb/909264: "Generally, we recommend that you register DNS names for internal and external namespaces with an Internet registrar. This includes the DNS names of Active Directory domains, unless such names are subdomains of DNS names that are registered by your organization name.". I remember reading a more explicit argument against ".local" somewhere else in TechNet or MSDN, but I can't remember where! – CesarGon Dec 1 '09 at 19:38
3

Don't use .local. Bonjour for OS X uses .local to do its "magic." Accordingly, if you use .local for your TLD, you'll need to jump through additional hoops if you ever plan on adding Macs to your network. .lan is nice and short.

Improve this answer
2

While not reserved .local is used by UPnP SSDP on the microsoft side of the world (apple uses it in Bonjour). I usually reccomend using .internal (note that .int is reserved)

Improve this answer
0

Microsoft actually doesn't recommend a .local suffix. They recommend a non-routable, yet unique domain or subdomain under the control of your company. They use copr.microsoft.com as an example.

Improve this answer
3
  • I know, I know... that's what I read. Why is Microsoft discouraging people from using the .local suffix if it's an officially recognised non-routable pseudo-TLD? Also, how can I obtain a non-routable, yet unique domain or subdomain under the control of my company? I mean, how can I guarantee that it's non-routable? Thanks. – CesarGon Dec 1 '09 at 1:48
  • 1
    In Small Business Server you get no choice over your domain TLD. It's set to .local and that's it. Interesting that they don't recommend this... – Mark Henderson Dec 1 '09 at 1:50
  • say you own mycompany.com. You can make corp.mycompany.com your internal AD domain and not have it externally routable. Or you can register a domain name and just never put anything externally accessible on it. No DNS enteries, etc. – MDMarra Dec 1 '09 at 2:23
0

I would also discourage the use of .local for the internal domain name. Choose something that's "not routable" but is significant to you and\or your organization.

http://en.wikipedia.org/wiki/.local

Improve this answer
0

If you have desktop linux systems that run AVAHI, you may run into trouble. I've been tracking this Ubuntu bug for nearly 3 years now where Ubuntu has trouble resolving DNS names that end in .local. So when I plug my linux laptop into a client network and try 'ssh admin@switch1.client.local' I end up with huge delays. There is a work-around in that bug, but it's still annoying. A lot of people have been recommending '.lan' instead of '.local'. On the other hand, you could always register a valid domain name or use a subdomain like corp.acme.com.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.